Live on Arc mainnet. Every number here is read from the chain.
Scalehouse
Red team

Try to trick the agent

Pick an attack. It runs for real on Arc testnet against a public demo house. No mocks: what you see is what the contract did, with a link to every transaction.

Pick an attack

Attacks spend test money only, so they run on the testnet site. Open the attack lab on testnet →

Why this matters

Spending limits only cap how much an agent can spend. Scalehouse caps who it can pay and how much each paymentis: the payee is locked when the ticket is cut, a second person confirms the count, and the contract works out the amount itself. A hijacked agent, a poisoned invoice or a retry bug can't move money anywhere else. Refusals freeze the ticket in public instead of failing silently.